mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-24 20:08:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profile): initial integration with attached path.

Browse source 
The feature is not yet enabled.

See https://apparmor.pujol.io/development/internal/#re-attached-path
This commit is contained in:
Alexandre Pujol 2024-10-11 14:13:17 +01:00
parent 5bf8c6ef0f
commit 61a27bc336
Failed to generate hash of commit
85 changed files with 164 additions and 139 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
apparmor.d/abstractions/attached/base Normal file
View file

@ -0,0 +1,14 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# LOGPROF-SUGGEST: no
# Do not use it manually, it is automatically included in profiles when it is required.
abi <abi/4.0>,
@{att}/apparmor/.null rw,
include if exists <abstractions/attached/base.d>
# vim:syntax=apparmor

13
apparmor.d/abstractions/attached/consoles Normal file
View file

@ -0,0 +1,13 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# LOGPROF-SUGGEST: no
abi <abi/4.0>,
owner @{att}/dev/pts/@{int} rw,
owner @{att}/dev/tty@{int} rw,
include if exists <abstractions/attached/consoles.d>
# vim:syntax=apparmor

3
apparmor.d/abstractions/common/app
View file

@ -67,10 +67,11 @@
owner @{tmp}/** rmwk, owner @{tmp}/** rmwk,
owner /dev/shm/** rwlk -> /dev/shm/**, owner /dev/shm/** rwlk -> /dev/shm/**,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/havahi-daemon/socket rw, # Allow access to avahi-daemon socket. @{run}/havahi-daemon/socket rw, # Allow access to avahi-daemon socket.
@{run}/host/{,**} r, @{run}/host/{,**} r,
@{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket. @{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket.
@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/utmp rk, @{run}/utmp rk,
@{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c13:@{int} r, # for /dev/input/*

13
apparmor.d/abstractions/common/bwrap
View file

@ -44,15 +44,16 @@
owner /tmp/newroot/ w, owner /tmp/newroot/ w,
owner /tmp/oldroot/ w, owner /tmp/oldroot/ w,
@{att}/@{PROC}/sys/user/max_user_namespaces rw,
owner @{att}/@{PROC}/@{pid}/cgroup r,
owner @{att}/@{PROC}/@{pid}/gid_map rw,
owner @{att}/@{PROC}/@{pid}/mountinfo r,
owner @{att}/@{PROC}/@{pid}/setgroups rw,
owner @{att}/@{PROC}/@{pid}/uid_map rw,
@{PROC}/sys/kernel/overflowgid r, @{PROC}/sys/kernel/overflowgid r,
@{PROC}/sys/kernel/overflowuid r, @{PROC}/sys/kernel/overflowuid r,
@{PROC}/sys/user/max_user_namespaces rw,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/gid_map rw,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/setgroups rw,
owner @{PROC}/@{pid}/uid_map rw,
include if exists <abstractions/common/bwrap.d> include if exists <abstractions/common/bwrap.d>

4
apparmor.d/groups/apt/apt
View file

@ -141,6 +141,8 @@ profile apt @{exec_path} flags=(attach_disconnected) {
owner @{tmp}/apt.conf.* rw, owner @{tmp}/apt.conf.* rw,
owner @{tmp}/apt.data.* rw, owner @{tmp}/apt.data.* rw,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{PROC}/@{pids}/cmdline r, @{PROC}/@{pids}/cmdline r,
@{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/mountinfo r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
@ -148,8 +150,6 @@ profile apt @{exec_path} flags=(attach_disconnected) {
/dev/ptmx rw, /dev/ptmx rw,
@{run}/systemd/inhibit/@{int}.ref rw,
profile editor flags=(complain) { profile editor flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/editor> include <abstractions/app/editor>

2
apparmor.d/groups/apt/unattended-upgrade
View file

@ -100,7 +100,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
/var/log/apt/{term,history}.log w, /var/log/apt/{term,history}.log w,
/var/log/apt/eipp.log.xz w, /var/log/apt/eipp.log.xz w,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{run}/unattended-upgrades.lock rwk, owner @{run}/unattended-upgrades.lock rwk,
owner @{run}/unattended-upgrades.pid rw, owner @{run}/unattended-upgrades.pid rw,
owner @{run}/unattended-upgrades.progress rw, owner @{run}/unattended-upgrades.progress rw,

2
apparmor.d/groups/apt/unattended-upgrade-shutdown
View file

@ -24,8 +24,8 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) {
owner /var/log/unattended-upgrades/*.log* rw, owner /var/log/unattended-upgrades/*.log* rw,
owner @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{run}/unattended-upgrades.lock rwk, owner @{run}/unattended-upgrades.lock rwk,
owner @{run}/systemd/inhibit/@{int}.ref rw,
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,

2
apparmor.d/groups/browsers/epiphany
View file

@ -39,7 +39,7 @@ profile epiphany @{exec_path} flags=(attach_disconnected) {
@{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKit{Web,Network}Process rix, @{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKit{Web,Network}Process rix,
owner /bindfile@{rand6} rw, owner /bindfile@{rand6} rw,
owner /.flatpak-info r, owner @{att}/.flatpak-info r,
owner @{user_config_dirs}/glib-2.0/ w, owner @{user_config_dirs}/glib-2.0/ w,
owner @{user_config_dirs}/glib-2.0/settings/ w, owner @{user_config_dirs}/glib-2.0/settings/ w,

3
apparmor.d/groups/bus/at-spi2-registryd
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,at-spi2{,-core}/}at-spi2-registryd @{exec_path} = @{lib}/{,at-spi2{,-core}/}at-spi2-registryd
profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) { profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.gnome.SessionManager> include <abstractions/bus/org.gnome.SessionManager>
@ -27,8 +28,6 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
owner /dev/tty@{int} rw,
include if exists <local/at-spi2-registryd> include if exists <local/at-spi2-registryd>
} }

3
apparmor.d/groups/bus/dbus-accessibility
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher @{exec_path} = @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher
profile dbus-accessibility @{exec_path} flags=(attach_disconnected) { profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
@ -72,8 +73,6 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/oom_score_adj r, owner @{PROC}/@{pid}/oom_score_adj r,
owner /dev/tty@{int} rw,
include if exists <local/dbus-accessibility> include if exists <local/dbus-accessibility>
} }

16
apparmor.d/groups/bus/dbus-system
View file

@ -49,17 +49,17 @@ profile dbus-system flags=(attach_disconnected) {
/etc/machine-id r, /etc/machine-id r,
/var/lib/dbus/machine-id r, /var/lib/dbus/machine-id r,
@{desktop_share_dirs}/icc/ r, @{att}/@{desktop_share_dirs}/icc/ r,
@{desktop_share_dirs}/icc/edid-@{hex32}.icc r, @{att}/@{desktop_share_dirs}/icc/edid-@{hex32}.icc r,
@{user_share_dirs}/icc/ r, @{att}/@{user_share_dirs}/icc/ r,
@{user_share_dirs}/icc/edid-@{hex32}.icc r, @{att}/@{user_share_dirs}/icc/edid-@{hex32}.icc r,
# Dbus can receive any user files # Dbus can receive any user files
@{HOME}/** r, @{HOME}/** r,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw,
@{run}/systemd/notify w, @{run}/systemd/notify w,
@{run}/systemd/sessions/*.ref rw,
@{run}/systemd/users/@{int} r, @{run}/systemd/users/@{int} r,
@{sys}/kernel/security/apparmor/.access rw, @{sys}/kernel/security/apparmor/.access rw,
@ -77,8 +77,8 @@ profile dbus-system flags=(attach_disconnected) {
owner @{PROC}/@{pid}/mounts r, owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/oom_score_adj rw, owner @{PROC}/@{pid}/oom_score_adj rw,
/dev/dri/card@{int} rw, @{att}/dev/dri/card@{int} rw,
/dev/input/event@{int} rw, @{att}/dev/input/event@{int} rw,
include if exists <local/dbus-system> include if exists <local/dbus-system>
} }

2
apparmor.d/groups/children/child-modprobe-nvidia
View file

@ -53,8 +53,6 @@ profile child-modprobe-nvidia flags=(attach_disconnected) {
owner /dev/nvidia-caps/ w, owner /dev/nvidia-caps/ w,
owner /dev/nvidia-caps/nvidia-cap@{int} w, owner /dev/nvidia-caps/nvidia-cap@{int} w,
/dev/tty@{int} rw,
deny @{HOME}/.steam/** r, deny @{HOME}/.steam/** r,
profile kmod { profile kmod {

4
apparmor.d/groups/freedesktop/colord
View file

@ -49,8 +49,8 @@ profile colord @{exec_path} flags=(attach_disconnected) {
owner /var/lib/snmp/mibs/{iana,ietf}/ r, owner /var/lib/snmp/mibs/{iana,ietf}/ r,
owner /var/lib/snmp/mibs/{iana,ietf}/[A-Z]* r, owner /var/lib/snmp/mibs/{iana,ietf}/[A-Z]* r,
@{desktop_share_dirs}/icc/edid-*.icc r, @{att}/@{desktop_share_dirs}/icc/edid-*.icc r,
@{user_share_dirs}/icc/edid-*.icc r, @{att}/@{user_share_dirs}/icc/edid-*.icc r,
@{run}/systemd/sessions/* r, @{run}/systemd/sessions/* r,

3
apparmor.d/groups/freedesktop/pipewire
View file

@ -45,7 +45,8 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
/etc/pipewire/{,**} r, /etc/pipewire/{,**} r,
/ r, / r,
/.flatpak-info r, @{att}/ r,
owner @{att}/.flatpak-info r,
owner @{user_config_dirs}/pipewire/{,**} r, owner @{user_config_dirs}/pipewire/{,**} r,

4
apparmor.d/groups/freedesktop/pipewire-pulse
View file

@ -28,8 +28,8 @@ profile pipewire-pulse @{exec_path} flags=(attach_disconnected) {
/var/lib/dbus/machine-id r, /var/lib/dbus/machine-id r,
/etc/machine-id r, /etc/machine-id r,
/ r, @{att}/ r,
/.flatpak-info r, owner @{att}/.flatpak-info r,
owner @{run}/user/@{uid}/pulse/pid w, owner @{run}/user/@{uid}/pulse/pid w,
owner @{tmp}/librnnoise-@{int}.so rm, owner @{tmp}/librnnoise-@{int}.so rm,

2
apparmor.d/groups/freedesktop/upowerd
View file

@ -41,7 +41,7 @@ profile upowerd @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c13:@{int} r, # for /dev/input/*
@{run}/udev/data/c116:@{int} r, # for ALSA @{run}/udev/data/c116:@{int} r, # for ALSA
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{sys}/bus/hid/devices/ r, @{sys}/bus/hid/devices/ r,
@{sys}/class/input/ r, @{sys}/class/input/ r,

4
apparmor.d/groups/freedesktop/xdg-dbus-proxy
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/xdg-dbus-proxy @{exec_path} = @{bin}/xdg-dbus-proxy
profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) { profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
@ -16,7 +17,6 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
include <abstractions/bus/org.freedesktop.Avahi> include <abstractions/bus/org.freedesktop.Avahi>
include <abstractions/bus/org.freedesktop.NetworkManager> include <abstractions/bus/org.freedesktop.NetworkManager>
include <abstractions/bus/org.freedesktop.portal.Desktop> include <abstractions/bus/org.freedesktop.portal.Desktop>
include <abstractions/consoles>
include <abstractions/user-download-strict> include <abstractions/user-download-strict>
network unix stream, network unix stream,
@ -31,7 +31,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.var/app/*/.local/share/*/logs/* rw, owner @{HOME}/.var/app/*/.local/share/*/logs/* rw,
owner @{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw, owner @{HOME}/.var/app/*/.local/share/*/**/usr/.ref rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{run}/firejail/dbus/@{int}/@{int}-{system,user} rw, owner @{run}/firejail/dbus/@{int}/@{int}-{system,user} rw,
owner @{run}/flatpak/doc/** r, owner @{run}/flatpak/doc/** r,
owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw, owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-@{rand6} rw,

3
apparmor.d/groups/freedesktop/xdg-desktop-portal
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) { profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/app-open> include <abstractions/app-open>
include <abstractions/attached/consoles>
include <abstractions/audio-client> include <abstractions/audio-client>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
@ -62,7 +63,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
@{open_path} rPx -> child-open, @{open_path} rPx -> child-open,
/ r, / r,
/.flatpak-info r, @{att}/.flatpak-info r,
/usr/share/dconf/profile/gdm r, /usr/share/dconf/profile/gdm r,
/usr/share/xdg-desktop-portal/** r, /usr/share/xdg-desktop-portal/** r,

3
apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/xdg-desktop-portal-gnome @{exec_path} = @{lib}/xdg-desktop-portal-gnome
profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) { profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
@ -65,8 +66,6 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/task/@{tid}/ r, owner @{PROC}/@{pid}/task/@{tid}/ r,
owner @{PROC}/@{pid}/task/@{tid}/status r, owner @{PROC}/@{pid}/task/@{tid}/status r,
owner /dev/tty@{int} rw,
include if exists <local/xdg-desktop-portal-gnome> include if exists <local/xdg-desktop-portal-gnome>
} }

8
apparmor.d/groups/freedesktop/xdg-document-portal
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/xdg-document-portal @{exec_path} = @{lib}/xdg-document-portal
profile xdg-document-portal @{exec_path} flags=(attach_disconnected) { profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.freedesktop.impl.portal.PermissionStore> include <abstractions/bus/org.freedesktop.impl.portal.PermissionStore>
include <abstractions/deny-sensitive-home> include <abstractions/deny-sensitive-home>
@ -39,8 +40,8 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
@{bin}/flatpak rPUx, @{bin}/flatpak rPUx,
@{bin}/fusermount{,3} rCx -> fusermount, @{bin}/fusermount{,3} rCx -> fusermount,
/ r, owner @{att}/ r,
owner /.flatpak-info r, owner @{att}/.flatpak-info r,
owner @{HOME}/ r, owner @{HOME}/ r,
owner @{HOME}/*/{,**} rw, owner @{HOME}/*/{,**} rw,
@ -57,7 +58,6 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
/dev/fuse rw, /dev/fuse rw,
owner /dev/tty@{int} rw,
profile fusermount flags=(attach_disconnected) { profile fusermount flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
@ -83,7 +83,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pids}/mounts r, @{PROC}/@{pids}/mounts r,
/dev/fuse rw, /dev/fuse rw,
owner /dev/tty@{int} rw, @{att}/dev/tty@{int} rw,
include if exists <local/xdg-document-portal_fusermount> include if exists <local/xdg-document-portal_fusermount>
} }

3
apparmor.d/groups/freedesktop/xdg-permission-store
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/xdg-permission-store @{exec_path} = @{lib}/xdg-permission-store
profile xdg-permission-store @{exec_path} flags=(attach_disconnected) { profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -45,8 +46,6 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/flatpak/db/documents rw, owner @{user_share_dirs}/flatpak/db/documents rw,
owner @{user_share_dirs}/flatpak/db/notifications rw, owner @{user_share_dirs}/flatpak/db/notifications rw,
/dev/tty@{int} rw,
include if exists <local/xdg-permission-store> include if exists <local/xdg-permission-store>
} }

2
apparmor.d/groups/freedesktop/xkbcomp
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/xkbcomp @{exec_path} = @{bin}/xkbcomp
profile xkbcomp @{exec_path} flags=(attach_disconnected) { profile xkbcomp @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/mesa> include <abstractions/mesa>
include <abstractions/X-strict> include <abstractions/X-strict>
@ -37,7 +38,6 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
/dev/dri/card@{int} rw, /dev/dri/card@{int} rw,
/dev/fb@{int} rw, /dev/fb@{int} rw,
/dev/tty rw, /dev/tty rw,
/dev/tty@{int} rw,
deny /dev/input/event@{int} rw, deny /dev/input/event@{int} rw,
deny /var/log/Xorg.@{int}.log w, deny /var/log/Xorg.@{int}.log w,

2
apparmor.d/groups/freedesktop/xwayland
View file

@ -36,7 +36,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
@{PROC}/@{pids}/cmdline r, @{PROC}/@{pids}/cmdline r,
/dev/tty@{int} rw, @{att}/dev/tty@{int} rw,
/dev/tty rw, /dev/tty rw,
include if exists <local/xwayland> include if exists <local/xwayland>

2
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -114,13 +114,13 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
owner @{run}/gdm{3,}/dbus/ w, owner @{run}/gdm{3,}/dbus/ w,
owner @{run}/gdm{3,}/dbus/dbus-@{rand8} w, owner @{run}/gdm{3,}/dbus/dbus-@{rand8} w,
@{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw,
@{run}/cockpit/active.motd r, @{run}/cockpit/active.motd r,
@{run}/faillock/@{user} rwk, @{run}/faillock/@{user} rwk,
@{run}/fscrypt/ rw, @{run}/fscrypt/ rw,
@{run}/fscrypt/@{uid}.count rwk, @{run}/fscrypt/@{uid}.count rwk,
@{run}/motd.d/{,*} r, @{run}/motd.d/{,*} r,
@{run}/systemd/sessions/* r, @{run}/systemd/sessions/* r,
@{run}/systemd/sessions/*.ref rw,
@{run}/systemd/users/@{uid} r, @{run}/systemd/users/@{uid} r,
@{run}/utmp rwk, @{run}/utmp rwk,

2
apparmor.d/groups/gnome/gjs-console
View file

@ -14,6 +14,7 @@ include <tunables/global>
@{exec_path} = @{bin}/gjs-console @{exec_path} = @{bin}/gjs-console
profile gjs-console @{exec_path} flags=(attach_disconnected) { profile gjs-console @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.portal.Desktop> include <abstractions/bus/org.freedesktop.portal.Desktop>
@ -85,7 +86,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
/dev/ r, /dev/ r,
/dev/tty rw, /dev/tty rw,
/dev/tty@{int} rw,
include if exists <local/gjs-console> include if exists <local/gjs-console>
} }

1
apparmor.d/groups/gnome/gnome-keyring-daemon
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/gnome-keyring-daemon @{exec_path} = @{bin}/gnome-keyring-daemon
profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) { profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.login1.Session> include <abstractions/bus/org.freedesktop.login1.Session>

2
apparmor.d/groups/gnome/gnome-music
View file

@ -48,7 +48,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/grilo-plugins/ rwk, owner @{user_share_dirs}/grilo-plugins/ rwk,
owner @{user_share_dirs}/grilo-plugins/*.db{,-shm,-journal,-wal} rwk, owner @{user_share_dirs}/grilo-plugins/*.db{,-shm,-journal,-wal} rwk,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw, owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw,
owner /var/tmp/etilqs_@{hex15} rw, owner /var/tmp/etilqs_@{hex15} rw,

7
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -79,9 +79,10 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/gnome-session/ rw, owner @{user_config_dirs}/gnome-session/ rw,
owner @{user_config_dirs}/gnome-session/saved-session/ rw, owner @{user_config_dirs}/gnome-session/saved-session/ rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{att}/@{run}/systemd/sessions/{,@{l}}@{int}.ref rw,
@{run}/systemd/sessions/* r, @{run}/systemd/sessions/* r,
@{run}/systemd/sessions/*.ref rw,
@{run}/systemd/users/@{uid} r, @{run}/systemd/users/@{uid} r,
owner @{run}/user/@{uid}/gnome-session-leader-fifo rw, owner @{run}/user/@{uid}/gnome-session-leader-fifo rw,
owner @{run}/user/@{uid}/ICEauthority rw, owner @{run}/user/@{uid}/ICEauthority rw,
@ -104,6 +105,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
profile open flags=(attach_disconnected) { profile open flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/desktop> include <abstractions/desktop>
@{bin}/env rix, @{bin}/env rix,
@ -119,7 +121,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/usr/games/** PUx, /usr/games/** PUx,
/dev/tty rw, /dev/tty rw,
/dev/tty@{int} rw,
include if exists <usr/gnome-session-binary_open.d> include if exists <usr/gnome-session-binary_open.d>
include if exists <local/gnome-session-binary_open> include if exists <local/gnome-session-binary_open>

11
apparmor.d/groups/gnome/gnome-shell
View file

@ -207,8 +207,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
/usr/share/xml/iso-codes/{,**} r, /usr/share/xml/iso-codes/{,**} r,
@{system_share_dirs}/gnome-shell/{,**} r, @{system_share_dirs}/gnome-shell/{,**} r,
/ r,
/.flatpak-info r,
/etc/fstab r, /etc/fstab r,
/etc/timezone r, /etc/timezone r,
/etc/tpm2-tss/*.json r, /etc/tpm2-tss/*.json r,
@ -220,6 +218,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
/var/lib/flatpak/app/**/gnome-shell/{,**} r, /var/lib/flatpak/app/**/gnome-shell/{,**} r,
/var/lib/flatpak/appstream/**/icons/** r, /var/lib/flatpak/appstream/**/icons/** r,
owner @{att}/ r,
owner @{att}/.flatpak-info r,
owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{GDM_HOME}/greeter-dconf-defaults r,
owner @{gdm_cache_dirs}/ w, owner @{gdm_cache_dirs}/ w,
owner @{gdm_cache_dirs}/event-sound-cache.tdb.@{hex32}.@{multiarch} rwk, owner @{gdm_cache_dirs}/event-sound-cache.tdb.@{hex32}.@{multiarch} rwk,
@ -293,11 +294,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{tmp}/@{rand6}.shell-extension.zip rw, owner @{tmp}/@{rand6}.shell-extension.zip rw,
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw, owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/systemd/users/@{uid} r, @{run}/systemd/users/@{uid} r,
@{run}/systemd/seats/seat@{int} r, @{run}/systemd/seats/seat@{int} r,
@{run}/systemd/sessions/ r, @{run}/systemd/sessions/ r,
@{run}/systemd/sessions/* r, @{run}/systemd/sessions/* r,
@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/udev/tags/seat/ r, @{run}/udev/tags/seat/ r,
@ -365,9 +367,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw,
owner @{PROC}/@{pid}/task/@{tid}/stat r, owner @{PROC}/@{pid}/task/@{tid}/stat r,
/dev/input/event@{int} rw,
/dev/media@{int} rw, /dev/media@{int} rw,
/dev/tty@{int} rw, /dev/tty@{int} rw,
@{att}/dev/dri/card@{int} rw,
@{att}/dev/input/event@{int} rw,
profile shell flags=(attach_disconnected,mediate_deleted) { profile shell flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/groups/gnome/gnome-software
View file

@ -111,7 +111,7 @@ profile gnome-software @{exec_path} {
owner /dev/shm/flatpak-com.*/ rw, owner /dev/shm/flatpak-com.*/ rw,
owner /dev/shm/flatpak-com.*/.flatpak-tmpdir rw, owner /dev/shm/flatpak-com.*/.flatpak-tmpdir rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/systemd/sessions/@{int} r, @{run}/systemd/sessions/@{int} r,
@{run}/systemd/users/@{uid} r, @{run}/systemd/users/@{uid} r,

3
apparmor.d/groups/gnome/gsd-a11y-settings
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-a11y-settings @{exec_path} = @{lib}/gsd-a11y-settings
profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) { profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.gnome.SessionManager> include <abstractions/bus/org.gnome.SessionManager>
include <abstractions/dconf-write> include <abstractions/dconf-write>
@ -31,8 +32,6 @@ profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) {
@{gdm_config_dirs}/dconf/user r, @{gdm_config_dirs}/dconf/user r,
@{GDM_HOME}/greeter-dconf-defaults r, @{GDM_HOME}/greeter-dconf-defaults r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-a11y-settings> include if exists <local/gsd-a11y-settings>
} }

3
apparmor.d/groups/gnome/gsd-color
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-color @{exec_path} = @{lib}/gsd-color
profile gsd-color @{exec_path} flags=(attach_disconnected) { profile gsd-color @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
@ -49,8 +50,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/icc/ rw, owner @{user_share_dirs}/icc/ rw,
owner @{user_share_dirs}/icc/edid-*.icc rw, owner @{user_share_dirs}/icc/edid-*.icc rw,
owner /dev/tty@{int} rw,
include if exists <local/gsd-color> include if exists <local/gsd-color>
} }

3
apparmor.d/groups/gnome/gsd-datetime
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-datetime @{exec_path} = @{lib}/gsd-datetime
profile gsd-datetime @{exec_path} flags=(attach_disconnected) { profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.gnome.SessionManager> include <abstractions/bus/org.gnome.SessionManager>
include <abstractions/dconf-write> include <abstractions/dconf-write>
@ -49,8 +50,6 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/fdinfo/@{int} r, owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/stat r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-datetime> include if exists <local/gsd-datetime>
} }

3
apparmor.d/groups/gnome/gsd-housekeeping
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) { profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/app-launcher-user> include <abstractions/app-launcher-user>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.gnome.SessionManager> include <abstractions/bus/org.gnome.SessionManager>
include <abstractions/bus/org.gtk.vfs.MountTracker> include <abstractions/bus/org.gtk.vfs.MountTracker>
@ -46,8 +47,6 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pids}/cgroup r, owner @{PROC}/@{pids}/cgroup r,
owner @{PROC}/@{pids}/mountinfo r, owner @{PROC}/@{pids}/mountinfo r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-housekeeping> include if exists <local/gsd-housekeeping>
} }

3
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-keyboard @{exec_path} = @{lib}/gsd-keyboard
profile gsd-keyboard @{exec_path} flags=(attach_disconnected) { profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
@ -39,8 +40,6 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/.gsd-keyboard.settings-ported* rw, owner @{user_config_dirs}/.gsd-keyboard.settings-ported* rw,
owner @{user_share_dirs}/gnome-settings-daemon/{,input-sources*} rw, owner @{user_share_dirs}/gnome-settings-daemon/{,input-sources*} rw,
owner /dev/tty@{int} rw,
include if exists <local/gsd-keyboard> include if exists <local/gsd-keyboard>
} }

5
apparmor.d/groups/gnome/gsd-media-keys
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-media-keys @{exec_path} = @{lib}/gsd-media-keys
profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/audio-client> include <abstractions/audio-client>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
@ -72,7 +73,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/recently-used.xbel{,.*} rw, owner @{user_share_dirs}/recently-used.xbel{,.*} rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/udev/data/+sound:card@{int} r, # For sound card @{run}/udev/data/+sound:card@{int} r, # For sound card
@{run}/udev/data/c13:@{int} r, # for /dev/input/* @{run}/udev/data/c13:@{int} r, # for /dev/input/*
@ -86,8 +87,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
@{PROC}/1/cgroup r, @{PROC}/1/cgroup r,
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-media-keys> include if exists <local/gsd-media-keys>
} }

5
apparmor.d/groups/gnome/gsd-power
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-power @{exec_path} = @{lib}/gsd-power
profile gsd-power @{exec_path} flags=(attach_disconnected) { profile gsd-power @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/audio-client> include <abstractions/audio-client>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
@ -60,7 +61,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/+drm:card@{int}-* r, # For screen outputs @{run}/udev/data/+drm:card@{int}-* r, # For screen outputs
@{run}/udev/data/+leds:* r, @{run}/udev/data/+leds:* r,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{sys}/bus/ r, @{sys}/bus/ r,
@{sys}/class/ r, @{sys}/class/ r,
@ -83,8 +84,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-power> include if exists <local/gsd-power>
} }

3
apparmor.d/groups/gnome/gsd-print-notifications
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-print-notifications @{exec_path} = @{lib}/gsd-print-notifications
profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.Avahi> include <abstractions/bus/org.freedesktop.Avahi>
@ -38,8 +39,6 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-print-notifications> include if exists <local/gsd-print-notifications>
} }

3
apparmor.d/groups/gnome/gsd-printer
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-printer @{exec_path} = @{lib}/gsd-printer
profile gsd-printer @{exec_path} flags=(attach_disconnected) { profile gsd-printer @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.gnome.SessionManager> include <abstractions/bus/org.gnome.SessionManager>
@ -29,8 +30,6 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-printer> include if exists <local/gsd-printer>
} }

3
apparmor.d/groups/gnome/gsd-rfkill
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-rfkill @{exec_path} = @{lib}/gsd-rfkill
profile gsd-rfkill @{exec_path} flags=(attach_disconnected) { profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.hostname1> include <abstractions/bus/org.freedesktop.hostname1>
@ -33,8 +34,6 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features @{run}/udev/data/c10:@{int} r, # for non-serial mice, misc features
owner /dev/tty@{int} rw,
/dev/rfkill rw, /dev/rfkill rw,
include if exists <local/gsd-rfkill> include if exists <local/gsd-rfkill>

3
apparmor.d/groups/gnome/gsd-screensaver-proxy
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-screensaver-proxy @{exec_path} = @{lib}/gsd-screensaver-proxy
profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) { profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.gnome.SessionManager> include <abstractions/bus/org.gnome.SessionManager>
@ -24,8 +25,6 @@ profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
owner /dev/tty@{int} rw,
include if exists <local/gsd-screensaver-proxy> include if exists <local/gsd-screensaver-proxy>
} }

3
apparmor.d/groups/gnome/gsd-sharing
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-sharing @{exec_path} = @{lib}/gsd-sharing
profile gsd-sharing @{exec_path} flags=(attach_disconnected) { profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus-system> include <abstractions/bus-system>
include <abstractions/bus/org.freedesktop.NetworkManager> include <abstractions/bus/org.freedesktop.NetworkManager>
@ -44,8 +45,6 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
@{PROC}/1/cgroup r, @{PROC}/1/cgroup r,
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-sharing> include if exists <local/gsd-sharing>
} }

3
apparmor.d/groups/gnome/gsd-smartcard
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-smartcard @{exec_path} = @{lib}/gsd-smartcard
profile gsd-smartcard @{exec_path} flags=(attach_disconnected) { profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.gnome.SessionManager> include <abstractions/bus/org.gnome.SessionManager>
include <abstractions/dconf-write> include <abstractions/dconf-write>
@ -42,8 +43,6 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3{,.lock} rwk, owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3{,.lock} rwk,
owner /dev/tty@{int} rw,
include if exists <local/gsd-smartcard> include if exists <local/gsd-smartcard>
} }

3
apparmor.d/groups/gnome/gsd-sound
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-sound @{exec_path} = @{lib}/gsd-sound
profile gsd-sound @{exec_path} flags=(attach_disconnected) { profile gsd-sound @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/audio-client> include <abstractions/audio-client>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.gnome.SessionManager> include <abstractions/bus/org.gnome.SessionManager>
@ -36,8 +37,6 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) {
owner @{user_share_dirs}/sounds/ rw, owner @{user_share_dirs}/sounds/ rw,
owner /dev/tty@{int} rw,
include if exists <local/gsd-sound> include if exists <local/gsd-sound>
} }

3
apparmor.d/groups/gnome/gsd-wacom
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/gsd-wacom @{exec_path} = @{lib}/gsd-wacom
profile gsd-wacom @{exec_path} flags=(attach_disconnected) { profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
@ -32,8 +33,6 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
owner @{gdm_config_dirs}/dconf/user r, owner @{gdm_config_dirs}/dconf/user r,
owner @{GDM_HOME}/greeter-dconf-defaults r, owner @{GDM_HOME}/greeter-dconf-defaults r,
owner /dev/tty@{int} rw,
include if exists <local/gsd-wacom> include if exists <local/gsd-wacom>
} }

3
apparmor.d/groups/gnome/mutter-x11-frames
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{lib}/mutter-x11-frames @{exec_path} = @{lib}/mutter-x11-frames
profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) { profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
include <abstractions/bus-session> include <abstractions/bus-session>
include <abstractions/bus/org.a11y> include <abstractions/bus/org.a11y>
@ -33,8 +34,6 @@ profile mutter-x11-frames @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
owner /dev/tty@{int} rw,
include if exists <local/mutter-x11-frames> include if exists <local/mutter-x11-frames>
} }

2
apparmor.d/groups/kde/kde-powerdevil
View file

@ -45,7 +45,7 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted)
owner @{user_config_dirs}/powermanagementprofilesrc.lock rwk, owner @{user_config_dirs}/powermanagementprofilesrc.lock rwk,
owner @{user_config_dirs}/powermanagementprofilesrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, owner @{user_config_dirs}/powermanagementprofilesrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/** @{run}/udev/data/c189:@{int} r, # for /dev/bus/usb/**
owner @{run}/user/@{uid}kcrash_@{int} rw, owner @{run}/user/@{uid}kcrash_@{int} rw,

2
apparmor.d/groups/kde/ksmserver
View file

@ -66,7 +66,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{tmp}/@{rand6} rw, owner @{tmp}/@{rand6} rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{run}/user/@{uid}/KSMserver__[0-9] rw, owner @{run}/user/@{uid}/KSMserver__[0-9] rw,
/dev/tty r, /dev/tty r,

2
apparmor.d/groups/kde/kwin_wayland
View file

@ -99,7 +99,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
owner /dev/shm/.org.chromium.Chromium.@{rand6} rw, owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{sys}/bus/ r, @{sys}/bus/ r,
@{sys}/class/ r, @{sys}/class/ r,

2
apparmor.d/groups/network/ModemManager
View file

@ -34,7 +34,7 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx @{run}/udev/data/c5:@{int} r, # for /dev/tty, /dev/console, /dev/ptmx
@{run}/udev/data/n@{int} r, @{run}/udev/data/n@{int} r,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{sys}/bus/ r, @{sys}/bus/ r,
@{sys}/bus/usb/devices/ r, @{sys}/bus/usb/devices/ r,

6
apparmor.d/groups/network/NetworkManager
View file

@ -95,7 +95,8 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
/usr/share/gvfs/remote-volume-monitors/{,*.monitor} r, /usr/share/gvfs/remote-volume-monitors/{,*.monitor} r,
/usr/share/iproute2/{,**} r, /usr/share/iproute2/{,**} r,
/ r, @{att}/ r,
/etc/ r, /etc/ r,
/etc/iproute2/* r, /etc/iproute2/* r,
/etc/machine-id r, /etc/machine-id r,
@ -115,11 +116,12 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
@{sys}/class/net/rfkill/ r, @{sys}/class/net/rfkill/ r,
@{sys}/class/rfkill/ r, @{sys}/class/rfkill/ r,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/network/ifstate r, @{run}/network/ifstate r,
@{run}/NetworkManager/{,**} rw, @{run}/NetworkManager/{,**} rw,
@{run}/nm-*.pid rw, @{run}/nm-*.pid rw,
@{run}/nscd/db* rwl, @{run}/nscd/db* rwl,
@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/systemd/users/@{uid} r, @{run}/systemd/users/@{uid} r,
@{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.)
@{run}/udev/data/+platform:* r, @{run}/udev/data/+platform:* r,

2
apparmor.d/groups/network/mullvad-gui
View file

@ -32,7 +32,7 @@ profile mullvad-gui @{exec_path} flags=(attach_disconnected) {
owner @{tmp}/.org.chromium.Chromium.@{rand6}/@{name}*.png rw, owner @{tmp}/.org.chromium.Chromium.@{rand6}/@{name}*.png rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
/dev/tty rw, /dev/tty rw,

3
apparmor.d/groups/ssh/sshd
View file

@ -97,12 +97,13 @@ profile sshd @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/@{XDG_SSH_DIR}/authorized_keys{,.*} r, owner @{HOME}/@{XDG_SSH_DIR}/authorized_keys{,.*} r,
owner @{user_cache_dirs}/{,motd*} rw, owner @{user_cache_dirs}/{,motd*} rw,
@{att}/@{run}/systemd/sessions/@{int}.ref rw,
@{run}/faillock/@{user} rwk, @{run}/faillock/@{user} rwk,
@{run}/motd.d/{,*} r, @{run}/motd.d/{,*} r,
@{run}/motd.dynamic rw, @{run}/motd.dynamic rw,
@{run}/motd.dynamic.new rw, @{run}/motd.dynamic.new rw,
@{run}/systemd/notify w, @{run}/systemd/notify w,
@{run}/systemd/sessions/*.ref rw,
owner @{run}/sshd{,.init}.pid wl, owner @{run}/sshd{,.init}.pid wl,
@{sys}/fs/cgroup/*/user/*/@{int}/ rw, @{sys}/fs/cgroup/*/user/*/@{int}/ rw,

2
apparmor.d/groups/systemd/systemd-inhibit
View file

@ -20,7 +20,7 @@ profile systemd-inhibit @{exec_path} flags=(attach_disconnected) {
@{bin}/cat rix, @{bin}/cat rix,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
include if exists <local/systemd-inhibit> include if exists <local/systemd-inhibit>
} }

4
apparmor.d/groups/systemd/systemd-networkd
View file

@ -50,9 +50,9 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
/etc/networkd-dispatcher/carrier.d/{,*} r, /etc/networkd-dispatcher/carrier.d/{,*} r,
/ r, @{att}/ r,
owner /var/lib/systemd/network/ r, owner @{att}/var/lib/systemd/network/ r,
@{run}/systemd/network/ r, @{run}/systemd/network/ r,
@{run}/systemd/network/*.network r, @{run}/systemd/network/*.network r,

2
apparmor.d/groups/ubuntu/update-manager
View file

@ -71,7 +71,7 @@ profile update-manager @{exec_path} flags=(attach_disconnected) {
owner @{user_cache_dirs}/update-manager-core/{,**} rw, owner @{user_cache_dirs}/update-manager-core/{,**} rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/mountinfo r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,

4
apparmor.d/groups/virt/dockerd
View file

@ -85,9 +85,9 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
/etc/docker/{,**} r, /etc/docker/{,**} r,
/ r, @{att}/ r,
owner @{lib}/containerd/** w, owner @{att}/@{lib}/containerd/** rw,
owner @{lib}/docker/overlay2/*/work/{,**} rw, owner @{lib}/docker/overlay2/*/work/{,**} rw,
owner /var/lib/containerd/** rw, owner /var/lib/containerd/** rw,
owner /var/lib/docker/{,**} rwk, owner /var/lib/docker/{,**} rwk,

3
apparmor.d/groups/virt/libvirtd
View file

@ -153,11 +153,12 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
@{user_vm_dirs}/{,**} rwk, @{user_vm_dirs}/{,**} rwk,
@{user_publicshare_dirs}/{,**} rwk, @{user_publicshare_dirs}/{,**} rwk,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/libvirt/ rw, @{run}/libvirt/ rw,
@{run}/libvirt/** rwk, @{run}/libvirt/** rwk,
@{run}/libvirtd.pid wk, @{run}/libvirtd.pid wk,
@{run}/lock/LCK.._pts_@{int} rw, @{run}/lock/LCK.._pts_@{int} rw,
@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/systemd/notify w, @{run}/systemd/notify w,
@{run}/utmp rk, @{run}/utmp rk,

2
apparmor.d/groups/virt/virtinterfaced
View file

@ -20,7 +20,7 @@ profile virtinterfaced @{exec_path} flags=(attach_disconnected) {
@{lib}/gconv/gconv-modules rm, @{lib}/gconv/gconv-modules rm,
@{lib}/gconv/gconv-modules.d/{,*} r, @{lib}/gconv/gconv-modules.d/{,*} r,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{run}/user/@{uid}/libvirt/common/system.token rwk, owner @{run}/user/@{uid}/libvirt/common/system.token rwk,
owner @{run}/user/@{uid}/libvirt/interface/ rw, owner @{run}/user/@{uid}/libvirt/interface/ rw,
owner @{run}/user/@{uid}/libvirt/interface/run/{,*} rwk, owner @{run}/user/@{uid}/libvirt/interface/run/{,*} rwk,

3
apparmor.d/groups/virt/virtlogd
View file

@ -28,9 +28,10 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/libvirt/virtlogd.pid rwk, owner @{run}/user/@{uid}/libvirt/virtlogd.pid rwk,
owner @{run}/user/@{uid}/libvirt/virtlogd* w, owner @{run}/user/@{uid}/libvirt/virtlogd* w,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/libvirt/common/system.token rwk, @{run}/libvirt/common/system.token rwk,
@{run}/libvirt/virtlogd-sock rw, @{run}/libvirt/virtlogd-sock rw,
@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/virtlogd.pid rwk, @{run}/virtlogd.pid rwk,
@{sys}/devices/system/node/ r, @{sys}/devices/system/node/ r,

3
apparmor.d/groups/virt/virtnetworkd
View file

@ -24,8 +24,9 @@ profile virtnetworkd @{exec_path} flags=(attach_disconnected) {
owner /var/lib/libvirt/dnsmasq/*.macs* rw, owner /var/lib/libvirt/dnsmasq/*.macs* rw,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/libvirt/network/default.pid r, @{run}/libvirt/network/default.pid r,
@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/utmp rk, @{run}/utmp rk,
owner @{run}/libvirt/common/system.token rwk, owner @{run}/libvirt/common/system.token rwk,
owner @{run}/libvirt/network/{,**} rwk, owner @{run}/libvirt/network/{,**} rwk,

3
apparmor.d/groups/virt/virtnodedevd
View file

@ -32,7 +32,8 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) {
/etc/libvirt/*.conf r, /etc/libvirt/*.conf r,
/etc/mdevctl.d/{,**} r, /etc/mdevctl.d/{,**} r,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{run}/libvirt/common/system.token rwk, owner @{run}/libvirt/common/system.token rwk,
owner @{run}/libvirt/nodedev/ rw, owner @{run}/libvirt/nodedev/ rw,
owner @{run}/libvirt/nodedev/driver.pid wk, owner @{run}/libvirt/nodedev/driver.pid wk,

3
apparmor.d/groups/virt/virtsecretd
View file

@ -20,7 +20,8 @@ profile virtsecretd @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/libvirt/secrets/ rw, owner @{user_config_dirs}/libvirt/secrets/ rw,
owner @{user_config_dirs}/libvirt/secrets/run/{,*} rwk, owner @{user_config_dirs}/libvirt/secrets/run/{,*} rwk,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{run}/user/@{uid}/libvirt/common/system.token rwk, owner @{run}/user/@{uid}/libvirt/common/system.token rwk,
owner @{run}/user/@{uid}/libvirt/secrets/ rw, owner @{run}/user/@{uid}/libvirt/secrets/ rw,
owner @{run}/user/@{uid}/libvirt/secrets/run/{,*} rwk, owner @{run}/user/@{uid}/libvirt/secrets/run/{,*} rwk,

3
apparmor.d/groups/virt/virtstoraged
View file

@ -54,7 +54,8 @@ profile virtstoraged @{exec_path} flags=(attach_disconnected) {
owner @{run}/libvirt/storage/{,**} rwk, owner @{run}/libvirt/storage/{,**} rwk,
owner @{run}/virtstoraged.pid rwk, owner @{run}/virtstoraged.pid rwk,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/utmp rwk, @{run}/utmp rwk,
@{sys}/devices/system/node/ r, @{sys}/devices/system/node/ r,

2
apparmor.d/groups/xfce/xfce-power-manager
View file

@ -21,7 +21,7 @@ profile xfce-power-manager @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/stat r,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
include if exists <local/xfce-power-manager> include if exists <local/xfce-power-manager>
} }

2
apparmor.d/groups/xfce/xfce-screensaver
View file

@ -25,7 +25,7 @@ profile xfce-screensaver @{exec_path} flags=(attach_disconnected) {
/etc/xdg/menus/xfce4-screensavers.menu r, /etc/xdg/menus/xfce4-screensavers.menu r,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
include if exists <local/xfce-screensaver> include if exists <local/xfce-screensaver>
} }

4
apparmor.d/profiles-a-f/flatpak-portal
View file

@ -31,8 +31,8 @@ profile flatpak-portal @{exec_path} flags=(attach_disconnected) {
/var/lib/flatpak/exports/share/mime/mime.cache r, /var/lib/flatpak/exports/share/mime/mime.cache r,
/ r, owner @{att}/ r,
/.flatpak-info r, owner @{att}/.flatpak-info r,
owner @{HOME}/.var/app/*/**/.ref rw, owner @{HOME}/.var/app/*/**/.ref rw,
owner @{HOME}/.var/app/*/**/logs/* rw, owner @{HOME}/.var/app/*/**/logs/* rw,

2
apparmor.d/profiles-a-f/foliate
View file

@ -40,7 +40,7 @@ profile foliate @{exec_path} flags=(attach_disconnected) {
/usr/share/com.github.johnfactotum.Foliate/{,**} r, /usr/share/com.github.johnfactotum.Foliate/{,**} r,
owner /bindfile@{rand6} rw, owner /bindfile@{rand6} rw,
owner /.flatpak-info r, owner @{att}/.flatpak-info r,
owner @{user_books_dirs}/{,**} r, owner @{user_books_dirs}/{,**} r,
owner @{user_torrents_dirs}/{,**} r, owner @{user_torrents_dirs}/{,**} r,

3
apparmor.d/profiles-a-f/fprintd
View file

@ -27,8 +27,9 @@ profile fprintd @{exec_path} flags=(attach_disconnected) {
/var/lib/fprint/{,**} rw, /var/lib/fprint/{,**} rw,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/systemd/journal/socket rw, @{run}/systemd/journal/socket rw,
@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511
@{sys}/class/hidraw/ r, @{sys}/class/hidraw/ r,

3
apparmor.d/profiles-a-f/fwupd
View file

@ -94,11 +94,12 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) {
@{sys}/kernel/security/tpm[0-9]/binary_bios_measurements r, @{sys}/kernel/security/tpm[0-9]/binary_bios_measurements r,
@{sys}/power/mem_sleep r, @{sys}/power/mem_sleep r,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/motd.d/ r, @{run}/motd.d/ r,
@{run}/motd.d/@{int}-fwupd* rw, @{run}/motd.d/@{int}-fwupd* rw,
@{run}/motd.d/fwupd/{,**} rw, @{run}/motd.d/fwupd/{,**} rw,
@{run}/mount/utab r, @{run}/mount/utab r,
@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/udev/data/* r, @{run}/udev/data/* r,
@{PROC}/@{pids}/fd/ r, @{PROC}/@{pids}/fd/ r,

2
apparmor.d/profiles-g-l/linuxqq
View file

@ -35,7 +35,7 @@ profile linuxqq @{exec_path} flags=(attach_disconnected) {
/etc/machine-id r, /etc/machine-id r,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/utmp r, @{run}/utmp r,
owner @{PROC}/@{pid}/loginuid r, owner @{PROC}/@{pid}/loginuid r,

2
apparmor.d/profiles-m-r/mission-control
View file

@ -25,7 +25,7 @@ profile mission-control @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal} rwk, owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal} rwk,
owner @{user_cache_dirs}/.mc_connections rw, owner @{user_cache_dirs}/.mc_connections rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
include if exists <local/mission-control> include if exists <local/mission-control>
} }

3
apparmor.d/profiles-m-r/nvtop
View file

@ -23,7 +23,8 @@ profile nvtop @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/nvtop/{,**} rw, owner @{user_config_dirs}/nvtop/{,**} rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/udev/data/+drm:card@{int}-* r, # for screen outputs @{run}/udev/data/+drm:card@{int}-* r, # for screen outputs
@{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.) @{run}/udev/data/+pci:* r, # Identifies all PCI devices (CPU, GPU, Network, Disks, USB, etc.)
@{run}/udev/data/c226:@{int} r, # For /dev/dri/card* @{run}/udev/data/c226:@{int} r, # For /dev/dri/card*

3
apparmor.d/profiles-m-r/packagekitd
View file

@ -94,7 +94,8 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
owner @{tmp}/apt-changelog-@{rand6}/.apt-acquire-privs-test.@{rand6} rw, owner @{tmp}/apt-changelog-@{rand6}/.apt-acquire-privs-test.@{rand6} rw,
owner @{tmp}/packagekit* rw, owner @{tmp}/packagekit* rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{run}/systemd/users/@{uid} r, owner @{run}/systemd/users/@{uid} r,
#aa:only opensuse #aa:only opensuse

2
apparmor.d/profiles-m-r/psi
View file

@ -57,7 +57,7 @@ profile psi @{exec_path} {
owner @{tmp}/etilqs_@{hex16} rw, owner @{tmp}/etilqs_@{hex16} rw,
owner @{tmp}/Psi.* rwl -> /tmp/#@{int}, owner @{tmp}/Psi.* rwl -> /tmp/#@{int},
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,

2
apparmor.d/profiles-m-r/psi-plus
View file

@ -57,7 +57,7 @@ profile psi-plus @{exec_path} {
owner @{tmp}/etilqs_@{hex16} rw, owner @{tmp}/etilqs_@{hex16} rw,
owner @{tmp}/Psi+.* rwl -> /tmp/#@{int}, owner @{tmp}/Psi+.* rwl -> /tmp/#@{int},
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
owner @{PROC}/@{pid}/cmdline r, owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mountinfo r,

2
apparmor.d/profiles-s-z/signal-desktop
View file

@ -40,7 +40,7 @@ profile signal-desktop @{exec_path} {
audit @{lib_dirs}/chrome-sandbox rPx, audit @{lib_dirs}/chrome-sandbox rPx,
@{lib_dirs}/chrome_crashpad_handler rix, @{lib_dirs}/chrome_crashpad_handler rix,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{sys}/fs/cgroup/user.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r, @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,

3
apparmor.d/profiles-s-z/spice-vdagent
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{bin}/spice-vdagent @{exec_path} = @{bin}/spice-vdagent
profile spice-vdagent @{exec_path} flags=(attach_disconnected) { profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
include <abstractions/audio-client> include <abstractions/audio-client>
include <abstractions/audio-server> include <abstractions/audio-server>
include <abstractions/bus-accessibility> include <abstractions/bus-accessibility>
@ -46,8 +47,6 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pids}/task/@{tid}/comm rw, owner @{PROC}/@{pids}/task/@{tid}/comm rw,
owner /dev/tty@{int} rw,
include if exists <local/spice-vdagent> include if exists <local/spice-vdagent>
} }

2
apparmor.d/profiles-s-z/steam
View file

@ -174,12 +174,12 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
owner @{tmp}/steam@{rand6}/{,**} rw, owner @{tmp}/steam@{rand6}/{,**} rw,
owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw, owner @{tmp}/vdpau-drivers-@{rand6}/{,**} rw,
owner @{att}/dev/shm/ValveIPCSHM_@{uid} rw,
owner /dev/shm/fossilize-*-@{int}-@{int} rw, owner /dev/shm/fossilize-*-@{int}-@{int} rw,
owner /dev/shm/u@{uid}-Shm_@{hex6} rw, owner /dev/shm/u@{uid}-Shm_@{hex6} rw,
owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw, owner /dev/shm/u@{uid}-Shm_@{hex6}@{h} rw,
owner /dev/shm/u@{uid}-Shm_@{hex8} rw, owner /dev/shm/u@{uid}-Shm_@{hex8} rw,
owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk, owner /dev/shm/u@{uid}-ValveIPCSharedObj-Steam rwk,
owner /dev/shm/ValveIPCSHM_@{uid} rw,
owner @{run}/user/@{uid}/ r, owner @{run}/user/@{uid}/ r,

2
apparmor.d/profiles-s-z/superproductivity
View file

@ -29,7 +29,7 @@ profile superproductivity @{exec_path} flags=(attach_disconnected) {
@{bin}/speech-dispatcher rPx, @{bin}/speech-dispatcher rPx,
@{open_path} rPx -> child-open-strict, @{open_path} rPx -> child-open-strict,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
include if exists <local/superproductivity> include if exists <local/superproductivity>
} }

3
apparmor.d/profiles-s-z/udisksd
View file

@ -104,11 +104,12 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
@{MOUNTS}/ rw, @{MOUNTS}/ rw,
@{MOUNTS}/*/ rw, @{MOUNTS}/*/ rw,
@{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/ r, @{run}/ r,
@{run}/mount/utab{,.*} rwk, @{run}/mount/utab{,.*} rwk,
@{run}/udisks2/{,**} rw, @{run}/udisks2/{,**} rw,
@{run}/systemd/seats/seat@{int} r, @{run}/systemd/seats/seat@{int} r,
@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/cryptsetup/ r, @{run}/cryptsetup/ r,
@{run}/cryptsetup/L* rwk, @{run}/cryptsetup/L* rwk,

2
apparmor.d/profiles-s-z/uname
View file

@ -14,7 +14,7 @@ profile uname @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
/dev/tty@{int} rw, @{att}/dev/tty@{int} rw,
deny network, deny network,
deny owner @{user_share_dirs}/gvfs-metadata/* r, deny owner @{user_share_dirs}/gvfs-metadata/* r,

2
apparmor.d/profiles-s-z/wechat-universal
View file

@ -46,7 +46,7 @@ profile wechat-universal @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.xwechat/{,**} rwk, owner @{HOME}/.xwechat/{,**} rwk,
owner @{HOME}/.sys1og.conf rw, owner @{HOME}/.sys1og.conf rw,
@{run}/systemd/inhibit/@{int}.ref rw, @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
@{run}/utmp r, @{run}/utmp r,
@{PROC}/@{pid}/net/route r, @{PROC}/@{pid}/net/route r,

3
apparmor.d/profiles-s-z/xbrlapi
View file

@ -9,14 +9,13 @@ include <tunables/global>
@{exec_path} = @{bin}/xbrlapi @{exec_path} = @{bin}/xbrlapi
profile xbrlapi @{exec_path} flags=(attach_disconnected) { profile xbrlapi @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/attached/consoles>
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
@{exec_path} mr, @{exec_path} mr,
/dev/tty@{int} rw,
include if exists <local/xbrlapi> include if exists <local/xbrlapi>
} }

1
apparmor.d/tunables/multiarch.d/system
View file

@ -151,7 +151,6 @@
@{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254 @{dynamic}=23[4-9] 24[0-9] 25[0-4] # range 234 to 254
@{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511 @{dynamic}+=38[4-9] 39[0-9] 4[0-9][0-9] 50[0-9] 51[0-1] # range 384 to 511
#aa:only abi3
# Attachment path for attach_disconnected.path flag. # Attachment path for attach_disconnected.path flag.
# Automatically generated and set in profile preamble on ABI4. Disabled on ABI3. # Automatically generated and set in profile preamble on ABI4. Disabled on ABI3.
@{att}=/ @{att}=/